| 1 | """ |
| 2 | Registry that maps SCA application categories to the package names you would |
| 3 | expect to find on agents via the Wazuh Indexer. |
| 4 | |
| 5 | To add support for a new application: |
| 6 | 1. Add a new entry to ``SCA_PACKAGE_REGISTRY`` below. |
| 7 | 2. Set ``sca_application`` to the value used in the CoPilot-SCA index.json |
| 8 | ``application`` field so the link back to available policies is automatic. |
| 9 | 3. List every package name pattern (lowercase) that indicates the software |
| 10 | is installed. These are matched with an OpenSearch **wildcard** query |
| 11 | (``*pattern*``), so partial names work. |
| 12 | """ |
| 13 | |
| 14 | from __future__ import annotations |
| 15 | |
| 16 | from dataclasses import dataclass |
| 17 | from dataclasses import field |
| 18 | from typing import Dict |
| 19 | from typing import List |
| 20 | |
| 21 | |
| 22 | @dataclass(frozen=True) |
| 23 | class ScaPackageEntry: |
| 24 | """A single entry in the SCA package registry.""" |
| 25 | |
| 26 | # Human-readable label shown in API responses. |
| 27 | display_name: str |
| 28 | |
| 29 | # The ``application`` value from the CoPilot-SCA index.json so we can |
| 30 | # cross-reference available policies automatically. |
| 31 | sca_application: str |
| 32 | |
| 33 | # Package-name patterns to search for in the Wazuh Indexer. Each |
| 34 | # pattern is matched case-insensitively with wildcards on both sides. |
| 35 | package_patterns: List[str] = field(default_factory=list) |
| 36 | |
| 37 | |
| 38 | # ── The registry ──────────────────────────────────────────────────────── |
| 39 | # Add new entries here as SCA policies are created for more applications. |
| 40 | |
| 41 | SCA_PACKAGE_REGISTRY: Dict[str, ScaPackageEntry] = { |
| 42 | "apache": ScaPackageEntry( |
| 43 | display_name="Apache HTTP Server", |
| 44 | sca_application="apache", |
| 45 | package_patterns=["apache2", "httpd", "apache2-bin", "apache2-utils"], |
| 46 | ), |
| 47 | "nginx": ScaPackageEntry( |
| 48 | display_name="NGINX", |
| 49 | sca_application="nginx", |
| 50 | package_patterns=["nginx", "nginx-common", "nginx-core", "nginx-full"], |
| 51 | ), |
| 52 | "iis": ScaPackageEntry( |
| 53 | display_name="Microsoft IIS", |
| 54 | sca_application="iis", |
| 55 | package_patterns=["iis", "w3svc"], |
| 56 | ), |
| 57 | "mysql": ScaPackageEntry( |
| 58 | display_name="MySQL / MariaDB", |
| 59 | sca_application="mysql", |
| 60 | package_patterns=[ |
| 61 | "mysql-server", |
| 62 | "mysql-community-server", |
| 63 | "mysql-common", |
| 64 | "mariadb-server", |
| 65 | "mariadb-common", |
| 66 | ], |
| 67 | ), |
| 68 | "postgresql": ScaPackageEntry( |
| 69 | display_name="PostgreSQL", |
| 70 | sca_application="postgresql", |
| 71 | package_patterns=["postgresql", "postgresql-common", "postgresql-client"], |
| 72 | ), |
| 73 | "sqlserver": ScaPackageEntry( |
| 74 | display_name="Microsoft SQL Server", |
| 75 | sca_application="sqlserver", |
| 76 | package_patterns=["mssql-server", "mssql-tools"], |
| 77 | ), |
| 78 | } |